Cloudwatch Log

Encrypted by default. Use to store data and transfer data to other places.
Can also be setup on on-premise server
Can send logs to
Kinesis Firehose
Kinesis Streams
S3
Lambda
Opensearch

Cloudwatch log insight

Can be used to analyze the store logs
query engine
not real time engine
It will only run for historical data not the realtime data.

Cloudwatch Unified Agent Metrics

CPU, RAM, Storage, Netstat, Swap spaces, processes

Cloudwatch Alarms

Composite Alarm

Can be used AND OR conditions for the alarm based on various metrics.

Cloudwatch Network Synthetic Monitor

Monitor and detect network issues between app on AWS and On-premise.
NO AGENTS NEEDED.

Event Bridge (Cloudwatch Events now)

Can trigger aws services on certain events.
three types

1. default event bus
2. partner event bus(can be used for partner services)
3. custom event bus(for own events)
   Resource based policy for cross account capabilities.

Cloudwatch container insights

Can be used with ECS, EKS, Fargate and kubernetes on EC2.

Cloudwatch lambda insights

Used for monitoring lambda functions.

Cloudwatch application insights

use to monitor applications that run on EC2 instances with selected technologies only.

CloudTrail

Provides governance, compliance and audit for account.
Enabled by default.
Get history of events.
SDK, CLI, Console and AWS services.
Can be used with event bridge to intercept the API calls.

CloudTrail Insights

Used to detect unusual activity in account.

CloudTrail Event Retention

Events are stored in CloudTrail for 90days. (can't be changed)
Store in S3 for longer retention.

AWS Config

Record configuration changes.
Helps with auditing and compliance of AWS resources.
Can use to build automate remediations.

Flow Log

Flow logs are used for VPC not for EC2 instances.